Reputation: 260

Adding IP address to my form

I have this php code.

<?php
      if (isset($_POST['name'], $_POST['post'])) {
             $cast = $_POST['cast'];
             $name = $_POST['name'];
             $email = $_POST['email'];
             $post = nl2br ($_POST['post']);
             $ipaddress = $_POST['ipaddress'];

if (empty($name) or empty($post)) {
             $error = 'All Fields Are Required!';
}else{
$query = $pdo->prepare('INSERT INTO comments (cast, name, email, post, ipaddress) VALUES(?, ?, ?, ?, ?)');
     $query->bindValue(1, $cast);
     $query->bindValue(2, $name);
     $query->bindValue(3, $email);
     $query->bindValue(4, $post);
     $query->bindValue(5, $ipaddress);

     $query->execute();
?>

And this form.

<?php if (isset($error)) { ?>
     <small style="color:#aa0000;"><?php echo $error; ?></small><br /><br />
<?php } ?>

<form action="episode.php?id=<?php echo $data['cast_id']; ?>" method="post" autocomplete="off" enctype="multipart/form-data">
<input type="text" name="name" placeholder="Name" /> / <input type="text" name="email" placeholder="Email" /><small style="color:#aa0000;">*</small><br /><br />
<textarea rows="10" cols="50" name="post" placeholder="Comment"></textarea><br /><br />
<input type="submit" value="Add Comment" />
<br /><br />
<small style="color:#aa0000;">* <b>Email will not be displayed publicly</b></small><br />
</form>

As you can see I have set up an IP address to be saved with this form in my database.

How can I add the IP address in the form? But I do not want this to be displayed to my users.

Is this possible?

Thank you.

Upvotes: 3

Answers (7)

haqsek2 group

Reputation: 11

You can use the below code to get the IP Address.

$ipaddress = $_SERVER['REMOTE_ADDR'];

Upvotes: 0

user2092317

Reputation: 3328

1). You donot need to add <?php echo $_SERVER['REMOTE_ADDR']; ?> to the form. If case it's easy to forge it (actually it's easy any case). Better add IP to data on server side.

2) You can also look to $_SERVER['HTTP_X_FORWARDED_FOR']. If the user have a proxy address, some of them (transparent proxies) place real user's IP there. $_SERVER['REMOTE_ADDR'] may not always contain the right address

3) Please note: The Data about IP's isn't trustworthy at all.

Upvotes: 2

Alex

Reputation: 342

The current Ip-address can be optained as such:

$ipaddress = $_SERVER['REMOTE_ADDR'];

Upvotes: 0

Gavin

Reputation: 2143

If you add ipaddress to your form then the user could change it as they wish (even if its a hidden element). You would be better getting the ip address from the request header...